On Fri, 25 Jan 2019 22:06:40 +0300
Andrei Borzenkov
Well, documentation you mention says quite clearly
If you prefer to manually create or maintain your PAM configuration files, make sure to disable pam-config for these files.
and then explains how to do it.
The explanation says: "When you create your PAM configuration files from scratch using the pam-config --create command, it creates symbolic links from the common-* to the common-*-pc files. pam-config only modifies the common-*-pc configuration files. Removing these symbolic links effectively disables pam-config, because pam-config only operates on the common-*-pc files and these files are not put into effect without the symbolic links. " On this machine, the common-* files are symlinks and the common-*-pc files are regular text files containing the code. If I remove the common-* links, I will be left with the common-*-pc configuration files, created by pam-config. Will PAM read those common-*-pc files or does it expect to find common-* ? Do I need to rename common-*-pc to common-* as well as removing the common-* links? Normally I would experiment with some file renaming, but I'm worried that if I get it wrong I might lock myself out of the machine. Many thanks for your help. Bob -- Bob